Docs
Documentation
Enclave is a control plane for running untrusted, agent-generated workloads inside isolated, credential-scoped, ephemeral sessions. Start with the architecture, learn the core concepts, then dive into the page for any package — each one documents its interfaces, key functions, and data contracts against the real source.
Getting started
Clone it, run the demo.
Everything runs on a laptop against the in-process simulator backend — no Kubernetes, no Docker. The demo proves containment end to end in one command.
# clone + install
pnpm install
# the whole containment story in one command:
pnpm demo # 4 hostile workloads contained + 1 clean run returns its result
# boot the full local stack (no Kubernetes, no Docker) + smoke + hot-reload:
pnpm adl:cloudConcepts & reference
The ideas behind a run
A handful of concepts describe every session. Each links to a focused page.
Architecture→
The whole system on one page: the caller, the control-plane hub, the sandbox, and the data flow between them.
ConceptSession lifecycle→
The phases a session moves through — pending → running → terminal — and the kill reasons for over-budget workloads.
ConceptContainment model→
gVisor, default-deny egress, secure pod defaults, credential withholding, and the four invariants Enclave will not break.
ConceptData contracts→
The wire-format types every package shares: Session, SessionResult, StreamFrame, EgressPolicy, the auth contract.
ReferenceREST API→
Every session route — method, path, required scope, and purpose — plus the JWT and API-key auth model.
ReferenceChangelog→
The build phases: containment core, live Kubernetes, console + end-to-end auth, and what's next.
Components
A page per package
Enclave is a pnpm/TypeScript monorepo. Data flows one way: every package depends on shared for the wire format; the control plane is the hub everything else talks to.
shared→
The single source of truth for the wire format — pure domain types, no runtime.
Packagecontrol-plane→
The hub: Fastify API, orchestrator, credential broker, audit log, SSE, backends.
Packagesdk→
The typed TypeScript client — run / stream / result / audit / teardown.
Packagemcp→
An MCP server re-exposing the API as five agent-callable tools.
Packageconsole→
The React web console — auth, org scoping, live stream + audit view.
Packagerunner→
The in-sandbox harness that executes the workload and emits the result.
Packagedeploy→
The Kubernetes manifests that enforce the containment.